From 950d2f039021c6fd8d476c08f10269c61bd1701e Mon Sep 17 00:00:00 2001 From: akallabeth Date: Mon, 22 Apr 2024 09:27:27 +0200 Subject: [PATCH] fix length of redirection strings length field is in bytes, when converting from UCS-2 use size in WCHAR CVE: CVE-2024-32662 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/626d10a94a88565d957ddc30768ed08b320049a7] Signed-off-by: Gyorgy Sarvari --- libfreerdp/core/redirection.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libfreerdp/core/redirection.c b/libfreerdp/core/redirection.c index 8538a9056..5343a071c 100644 --- a/libfreerdp/core/redirection.c +++ b/libfreerdp/core/redirection.c @@ -243,7 +243,7 @@ static BOOL rdp_redirection_read_base64_wchar(UINT32 flag, wStream* s, UINT32* p const WCHAR* wchar = (const WCHAR*)ptr; size_t utf8_len = 0; - char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength, &utf8_len); + char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength / sizeof(WCHAR), &utf8_len); if (!utf8) goto fail;